Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 03:39
Static task
static1
Behavioral task
behavioral1
Sample
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe
Resource
win7-20220718-en
General
-
Target
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe
-
Size
305KB
-
MD5
ffa3fb48a339894ea095d4daf804011c
-
SHA1
1d9466444dad77922aec5a800fef77b83b715c18
-
SHA256
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
-
SHA512
6327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
Malware Config
Extracted
formbook
3.8
hx237
repuestosmamparaselsur.com
sakai-yukiko.com
getdistrict.com
hideinplainflight.info
yamaer.com
hoosholic-boy.com
thecopenhagencopywriter.com
ledressingdescompulsives.com
xn--h3t926bkqa394a.com
nvcxr.com
zhangbin2016.com
ajsfibresolutions.net
229riverbendlane.com
gnimble.com
pichacola.com
kochang.online
fishonfellowship.com
mandarinassinpepitas.com
drinkopr.win
silverm.cloud
rentalcoins.info
facepayfor.com
justbyoubeayutiful.com
grandgentlemen.com
nyss6ttyn3.online
bjoraclewdp.com
chairrole.site
huclub.com
e2mw.com
ya298.com
momoe365.com
printsites.info
neeqly.com
banque-societegeneralefr.net
colmund.com
baronlaw.net
wafigraphy.com
etherclan.com
saps-enterprise.com
xinfushunddc.com
tv16760.info
783bet.com
yongtai308.com
julianabass.site
czxyws.com
zjgewy.com
ytbaoyu.com
manbet086.com
pixelpandemic.com
dreamdentistrytx.com
brjx668.com
hyhdtjm.com
bumijawa.online
testbestdeal2.com
bodychange21.com
dg6yg1bp4.online
iiird.com
luckywechat.com
businesns.com
xn--2j1b67o19hn8l.net
veqwxx.info
cicekbi.net
iphone-10.repair
thorsthunderhq.com
aibbybrown-music.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1768-71-0x000000000041B610-mapping.dmp formbook behavioral1/memory/1768-70-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1768-75-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1768-83-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1908-87-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
cnxuoiren.execnxuoiren.exepid process 844 cnxuoiren.exe 1768 cnxuoiren.exe -
Drops startup file 2 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1548 cmd.exe 1548 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.execontrol.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\cnxuoirenmcxcz = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\cnxuoirenmcxcz.txt | cmd" reg.exe Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run control.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KTXDSFWH5RF = "C:\\Program Files (x86)\\L8ptdb08\\colorcpl2d3.exe" control.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
cnxuoiren.execnxuoiren.execontrol.exedescription pid process target process PID 844 set thread context of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 1768 set thread context of 1216 1768 cnxuoiren.exe Explorer.EXE PID 1768 set thread context of 1216 1768 cnxuoiren.exe Explorer.EXE PID 1908 set thread context of 1216 1908 control.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
control.exedescription ioc process File opened for modification C:\Program Files (x86)\L8ptdb08\colorcpl2d3.exe control.exe -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-4084403625-2215941253-1760665084-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.execnxuoiren.execnxuoiren.execontrol.exepid process 992 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe 992 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe 844 cnxuoiren.exe 844 cnxuoiren.exe 1768 cnxuoiren.exe 1768 cnxuoiren.exe 1768 cnxuoiren.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe 1908 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
cnxuoiren.execontrol.exepid process 1768 cnxuoiren.exe 1768 cnxuoiren.exe 1768 cnxuoiren.exe 1768 cnxuoiren.exe 1908 control.exe 1908 control.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.execnxuoiren.execnxuoiren.execontrol.exedescription pid process Token: SeDebugPrivilege 992 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe Token: SeDebugPrivilege 844 cnxuoiren.exe Token: SeDebugPrivilege 1768 cnxuoiren.exe Token: SeDebugPrivilege 1908 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.execmd.execnxuoiren.execmd.execnxuoiren.execontrol.exedescription pid process target process PID 992 wrote to memory of 1548 992 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe cmd.exe PID 992 wrote to memory of 1548 992 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe cmd.exe PID 992 wrote to memory of 1548 992 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe cmd.exe PID 992 wrote to memory of 1548 992 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe cmd.exe PID 1548 wrote to memory of 844 1548 cmd.exe cnxuoiren.exe PID 1548 wrote to memory of 844 1548 cmd.exe cnxuoiren.exe PID 1548 wrote to memory of 844 1548 cmd.exe cnxuoiren.exe PID 1548 wrote to memory of 844 1548 cmd.exe cnxuoiren.exe PID 844 wrote to memory of 960 844 cnxuoiren.exe cmd.exe PID 844 wrote to memory of 960 844 cnxuoiren.exe cmd.exe PID 844 wrote to memory of 960 844 cnxuoiren.exe cmd.exe PID 844 wrote to memory of 960 844 cnxuoiren.exe cmd.exe PID 960 wrote to memory of 880 960 cmd.exe reg.exe PID 960 wrote to memory of 880 960 cmd.exe reg.exe PID 960 wrote to memory of 880 960 cmd.exe reg.exe PID 960 wrote to memory of 880 960 cmd.exe reg.exe PID 844 wrote to memory of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 844 wrote to memory of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 844 wrote to memory of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 844 wrote to memory of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 844 wrote to memory of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 844 wrote to memory of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 844 wrote to memory of 1768 844 cnxuoiren.exe cnxuoiren.exe PID 1768 wrote to memory of 1908 1768 cnxuoiren.exe control.exe PID 1768 wrote to memory of 1908 1768 cnxuoiren.exe control.exe PID 1768 wrote to memory of 1908 1768 cnxuoiren.exe control.exe PID 1768 wrote to memory of 1908 1768 cnxuoiren.exe control.exe PID 1908 wrote to memory of 1012 1908 control.exe cmd.exe PID 1908 wrote to memory of 1012 1908 control.exe cmd.exe PID 1908 wrote to memory of 1012 1908 control.exe cmd.exe PID 1908 wrote to memory of 1012 1908 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe"C:\Users\Admin\AppData\Local\Temp\5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe"2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cnxuoirenmcxcz" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\cnxuoirenmcxcz.txt" | cmd"6⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"6⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"7⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\82388PD5\823logim.jpegFilesize
61KB
MD5176088220f3466f49644bb1038fe47f6
SHA1dbf793a197304511b58b4c32af37d65b80059e01
SHA256310103cb35f51cdaa2ccee73b65fccb820191f7a30487760b7f0b9be8226fcca
SHA512a78fd652b2cf87e875eae417a0d1c3fb596f17c90c3df2cd5a966bc0e68b2e7df8258e04b9cb0cf47e7ce34abc0346ec4bcc9bebeee141af813aae8da968cb3a
-
C:\Users\Admin\AppData\Roaming\82388PD5\823logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\82388PD5\823logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
memory/844-74-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/844-60-0x0000000000000000-mapping.dmp
-
memory/844-64-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/880-66-0x0000000000000000-mapping.dmp
-
memory/960-65-0x0000000000000000-mapping.dmp
-
memory/992-63-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/992-55-0x0000000074A50000-0x0000000074FFB000-memory.dmpFilesize
5.7MB
-
memory/992-54-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB
-
memory/1012-85-0x0000000000000000-mapping.dmp
-
memory/1216-81-0x0000000006710000-0x000000000683A000-memory.dmpFilesize
1.2MB
-
memory/1216-91-0x00000000041F0000-0x0000000004287000-memory.dmpFilesize
604KB
-
memory/1216-90-0x00000000041F0000-0x0000000004287000-memory.dmpFilesize
604KB
-
memory/1216-78-0x0000000004A50000-0x0000000004BF6000-memory.dmpFilesize
1.6MB
-
memory/1548-56-0x0000000000000000-mapping.dmp
-
memory/1768-75-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1768-70-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1768-67-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1768-83-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1768-77-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1768-68-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1768-71-0x000000000041B610-mapping.dmp
-
memory/1768-80-0x0000000000200000-0x0000000000214000-memory.dmpFilesize
80KB
-
memory/1768-76-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1908-89-0x00000000008D0000-0x0000000000963000-memory.dmpFilesize
588KB
-
memory/1908-88-0x0000000002220000-0x0000000002523000-memory.dmpFilesize
3.0MB
-
memory/1908-87-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/1908-86-0x0000000000E00000-0x0000000000E1F000-memory.dmpFilesize
124KB
-
memory/1908-82-0x0000000000000000-mapping.dmp